@zerohash-sdk/crypto-withdrawals-react@1.15.12
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Withdrawals product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package performs undisclosed runtime telemetry when its hosted widget fails to load, including the page origin, browser user agent, and selected JWT claims. This warrants a warning; the source does not show the JWT itself being sent or an unrelated destination being contacted.
Static reason
No blocking static signals were detected.
Trigger
The React component is rendered and its hosted widget fails to load.
Impact
The collector receives identifying application and browser context and participant or platform claims without a documented disclosure or opt-out.
Mechanism
The failure handler posts a JSON report containing app metadata, selected claims, browser user agent, page origin, and load-failure details.
AI rationale
The package performs undisclosed runtime telemetry when its hosted widget fails to load, including the page origin, browser user agent, and selected JWT claims. This warrants a warning; the source does not show the JWT itself being sent or an unrelated destination being contacted.
Evidence
dist/index.jsREADME.md
Network endpoints12
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.gating.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eu
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports a React SDK for ZeroHash’s crypto withdrawal product.
- Rendering the component loads its hosted web component and passes it the supplied JWT.
- When script loading fails, the component sends an error report to a ZeroHash Faro collector.
- The report includes app metadata, selected JWT claims, browser user agent, and the page origin.
- The README does not disclose this reporting or describe a way to disable it.
Evidence against
- There are no lifecycle scripts; the reporting occurs at runtime after the component is rendered.
- The report sends selected JWT claims rather than the JWT itself.
- The collector hosts belong to ZeroHash, and reporting is tied to a widget load failure.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedREADME.mdView file
1# @zerohash-sdk/crypto-withdrawals-react
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Withdrawals product.
Connect Crypto Withdrawals provides a secure, customizable flow for withdrawing crypto assets directly within your application.
## Requirements
- React 18.0.0 or higher
- React DOM 18.0.0 or higher
## Installation
```bash
npm install @zerohash-sdk/crypto-withdrawals-react
```
## Getting Started
### 1. Import the CryptoWithdrawals Component
```tsx
import { CryptoWith
Medium
Ai Review Evidence
The package exports a React SDK for ZeroHash’s crypto withdrawal product.
README.mdView on unpkg · L11# @zerohash-sdk/crypto-withdrawals-react
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Withdrawals product.
Connect Crypto Withdrawals provides a secure, customizable flow for withdrawing crypto assets directly within your application.
## Requirements
- React 18.0.0 or higher
- React DOM 18.0.0 or higher
## Installation
```bash
npm install @zerohash-sdk/crypto-withdrawals-react
```
## Getting Started
### 1. Import the CryptoWithdrawals Component
```tsx
import { CryptoWith
Medium
Ai Review Evidence
The README does not disclose this reporting or describe a way to disable it.
README.mdView on unpkg · L1Findings
7 Medium1 Low
MediumNetwork
MediumAi Review EvidenceREADME.md
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review EvidenceREADME.md
MediumAi Review Evidencedist/index.js
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-withdrawals-react@1.15.12.
See all versions of @zerohash-sdk/crypto-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-withdrawals-react@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.